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DETAILED ACTION 

1 . Claims 1 , 3-5, 8, 1 0-1 2, 1 4-1 6, 1 8-1 9, 21 , 23-25, and 28-30 are pending in tlnis 
application. Claims 2, 6-7, 9, 13, 17, 20, 22, 26, and 27 have been canceled as filed on 
3/20/2008. Claims 1, 3-5, 8, 10-12, 15-16, 18-19, 21, 23-25, and 28-30 have been 
amended as filed on 3/20/2008. 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claims 1, 3-5, 8, 10-12, 14-16, 18-19, 21, 23-25, and 28-30 are rejected under 
35 U.S.C. 103(a) as being unpatentable over Marwaha (US 2003/0200486), 
hereinafter Marwaha, in view of Natarajan et al. (US 6,584,502 B1), hereinafter 
Natarajan. 

4. With respect to Claim 1 , Marwaha discloses: "A method of generating events 
having a common event format (Page 14, Paragraph [0011], lines 1-4), comprising: 
associating a content handler with the event factory (Figure 3, objects 304a, b and c, 
and [0030], lines 7-9, the table below this and Paragraph [0031], lines 1-2, where a 
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content handler is the CEF translator and the event factory is the Listener/Receiver); 
obtaining a common base event associated with the content handler ([0028], lines 1-5, 
Figure 3, objects 304a, b and c); populating the common base event with source 
specific situation information to provide a populated base event ([0026], line 5, "object", 
defined later to be "To identify the affected component". Page 15, 1st Col., under the 
Object heading); determining if a format of the populated common base event conforms 
to a predefined event format ([0025], lines 8-1 1 , where during data normalization the 
event format may be updated, shown by [0027], lines 1-3, the data normalization phase 
determines if the format is acceptable, and if not updates the format, see Pg 14, the 
table below [0027], specifically "OriginDateTime", Remarks "If the original date/time is 
present, then that may be used"), wherein the predefined event format is defined by the 
content handler ([0025], lines 8-1 1 , where the data normalization transformer gathers 
the predefined information such as source, type, and status); and generating a common 
event format representation of the populated base event based on the predefined event 
format if the format of the populated base event does not conform to the predefined 
event format ([0027], lines 1-3)". 

Marwaha does not disclose: "associating an event factory with a directory 
service; locating the event factory using the directory service" or "returning the 
populated base event incorporated in the content handler from the event factory to the 
event source". 

However, Natarajan discloses: "associating an event factory with a directory 
service (Col. 26, lines 6-10); locating the event factory using the directory service (Col. 
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26, lines 6-10)" or "returning the populated base event incorporated in the content 
handler from the event factory to the event source (Col. 7, lines 27-30, where the event 
information was reported to a policy engine, updated, and is sent back to selected 
network elements)". 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the event notification of Marwaha with the teachings of Natarajan to 
include using a directory service to locate the event factory. Motivation to combine 
these references comes from the function of a directory service itself. Directory 
services are provided to store and organize information regarding a network, such as 
mapping network addresses to names of their respective network devices, relieving 
users from using unfriendly network addresses. Combining the event notification of 
Marwaha with the location of the event factory using a directory service of Natarajan 
therefore creates a more user friendly experience by allowing the user to specify a 
name rather than a network address. 

Also, it would have been obvious to one of ordinary skill in the art at the time of 
the invention to modify the event notification of Marwaha with the teachings of Natarajan 
to include sending the information back to the source. Motivation comes from 
Natarajan, "The updated control information is fed back to selected network elements to 
thereby affect operation of the selected elements" (Abstract, lines 9-1 1 ). By combining 
the event notification of Marwaha with sending information back to the source of 
Natarajan, the event notification system can affect operation of the elements based on 
event notification data. 
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5. With respect to Claim 12, Marwalia discloses: "A system for generating events 
having a common event format ([001 1], lines 1-4), comprising: an event factory module 
configured to generate instances of a common base event object (Figure 3, objects 
304a, b and c, [0030], lines 7-9, the table below this and [0031], lines 1-2); an event 
source configured to obtain an instance of the common base event object ([0025], lines 
3-4, Figure 2 shows the listener/receiver, 202, which listens for incoming events) and 
populate the common base event object with source specific situation information to 
provide a populated base event object ([0026], line 5, "object", defined later to be "To 
identify the affected component". Page 15, 1st Col., under the Object heading), the 
instance of the common base event object incorporating a content handler module 
([0028], lines 1-5, Figure 3, objects 304a, b, and c); and an event emitter module 
configured to utilize the content handler module of the populated common base event 
object to generate a common event format representation of the populated common 
base event object ( [0036], lines 1-2 and the following table) and provide the common 
event format representation of the populated common base event object to an event 
server ( [0037], lines 1-2, the PEM being described in [0038] as "PATROL Enterprise 
Manager ... PATROL resides on individual hosts and monitors different parameters for 
exceptions, and generates alert information which PEM may gather")", and "and 
wherein the event factory module is further configured to associate the content handler 
module with the event factory module (Figure 3, objects 304a, b and c, Page 15, 
Paragraph [0030], lines 7-9, the table below this and Paragraph [0031], lines 1-2)". 
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Marwaha does not disclose: "wherein the event source is further configured to 
locate the event factory module using a directory service", or "and return the populated 
base event object incorporated in the associated content handler module to the event 
source". 

However Natarajan discloses: "wherein the event source is further configured to 
locate the event factory module using a directory service (Col. 26, lines 6-10), 
and return the populated base event object incorporated in the associated content 
handler module to the event source (Col. 7, lines 27-30, where the event information 
was reported to a policy engine, updated, and is sent back to selected network 
elements)". 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the event notification of Marwaha with the teachings of Natarajan to 
include using a directory service to locate the event factory. Motivation to combine 
these references comes from the function of a directory service itself. Directory 
services are provided to store and organize information regarding a network, such as 
mapping network addresses to names of their respective network devices, relieving 
users from using unfriendly network addresses. Combining the event notification of 
Marwaha with the location of the event factory using a directory service of Natarajan 
therefore creates a more user friendly experience by allowing the user to specify a 
name rather than a network address. 

Also, it would have been obvious to one of ordinary skill in the art at the time of 
the invention to modify the event notification of ManA/aha with the teachings of Natarajan 



Application/Control Number: 10/809,175 Page 7 

Art Unit: 2100 

to include sending tlie information back to the source. Motivation comes from 
Natarajan, "Tlie updated control information is fed back to selected network elements to 
thereby affect operation of the selected elements" (Abstract, lines 9-11). By combining 
the event notification of Marwaha with sending information back to the source of 
Natarajan, the event notification system can affect operation of the elements based on 
event notification data. 

6. With respect to Claim 21 , Marwaha discloses: "A computer program product for 
generating events having a common event format (Page 14, Paragraph [0011], lines 1- 
4), comprising: a computer readable storage medium having computer readable 
program code embodied therein, the computer readable program code comprising: 
computer readable program code configured to associate a content handler with the 
event factory (Figure 3, objects 304a, b and c, and [0030], lines 7-9, the table below this 
and Paragraph [0031], lines 1-2, where a content handler is the CEF translator and the 
event factory is the Listener/Receiver); computer readable program code configured to 
obtain a common base event associated with the content handler ([0028], lines 1-5, 
Figure 3, objects 304a, b and c); computer readable program code configured to 
populate the common base event with source specific situation information to provide a 
populated base event ([0026], line 5, "object", defined later to be "To identify the 
affected component". Page 15, 1st Col., under the Object heading); computer readable 
program code configured to determine if a format of the populated common base event 
conforms to a predefined event format ([0025], lines 8-1 1 , where during data 
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normalization the event format may be updated, shown by [0027], lines 1-3, the data 
normalization phase determines if the format is acceptable, and if not updates the 
format, see Pg 14, the table below [0027], specifically "OriginDateTime", Remarks "If the 
original date/time is present, then that may be used"), wherein the predefined event 
format is defined by the content handler ([0025], lines 8-1 1 , where the data 
normalization transformer gathers the predefined information such as source, type, and 
status); and computer readable program code configured to generate a common event 
format representation of the populated base event based on the predefined event 
format if the format of the populated base event does not conform to the predefined 
event format ([0027], lines 1-3)". 

Marwaha does not disclose: "computer readable program code configured to 
associate an event factory with a directory service; computer readable program code 
configured to locate the event factory using the directory service", or "computer 
readable program code configured to return the common base event incorporated in the 
associated content handler from the event factory to the event source" 

However, Natarajan discloses: "computer readable program code configured to 
associate an event factory with a directory service (Col. 26, lines 6-10); computer 
readable program code configured to locate the event factory using the directory service 
(Col. 26, lines 6-10)", or "computer readable program code configured to return the 
common base event incorporated in the associated content handler from the event 
factory to the event source (Col. 7, lines 27-30, where the event information was 
reported to a policy engine, updated, and is sent back to selected network elements)". 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the event notification of Marwaha with the teachings of Natarajan to 
include using a directory service to locate the event factory. Motivation to combine 
these references comes from the function of a directory service itself. Directory 
services are provided to store and organize information regarding a network, such as 
mapping network addresses to names of their respective network devices, relieving 
users from using unfriendly network addresses. Combining the event notification of 
Marwaha with the location of the event factory using a directory service of Natarajan 
therefore creates a more user friendly experience by allowing the user to specify a 
name rather than a network address. 

Also, it would have been obvious to one of ordinary skill in the art at the time of 
the invention to modify the event notification of Marwaha with the teachings of Natarajan 
to include sending the information back to the source. Motivation comes from 
Natarajan, "The updated control information is fed back to selected network elements to 
thereby affect operation of the selected elements" (Abstract, lines 9-11). By combining 
the event notification of Marwaha with sending information back to the source of 
Natarajan, the event notification system can affect operation of the elements based on 
event notification data. 

7. With respect to Claims 3 and 23, the combination of Marwaha and Natarajan 
disclose: "wherein the source specific situation information is provided in a plurality of 
event fields (Marwaha, [0026], lines 2-7) and wherein generating a common event 
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format representation of tine populated base event comprises: determining if ones of the 
plurality of event fields conform to the predefined event format defined by the content 
handler (Marwaha, [0017], lines 1-3, "The following tables show examples of tokens and 
their values that may be updated", if the value are to be updated, they are checked 
against some standard, see [0030], lines 1-5); modifying the format of the ones of the 
plurality of event fields that do not conform to the predefined event format (Marwaha, 
[0017], lines 1-3, "The following tables show examples of tokens and their values that 
may be updated"); determining if ones of the plurality of event fields are empty 
(Marwaha, [0027], lines 1-3, "The following tables show examples of tokens and their 
values that may be updated or assigned values", assigning a value implies the value 
was not present during an inspection stage); and populating the empty ones of the 
plurality of event fields with source specific situation information based on the 
predefined event format (Marwaha, [0027], lines 1-3, "The following tables show 
examples of tokens and their values that may be updated or assigned values")". 

8. With respect to Claims 4 and 24, the combination of Marwaha and Natarajan 
disclose: "further comprising: providing the common event format representation of the 
populated base event to an event server (Marwaha, [0037], lines 1-2); and storing the 
common event format representation of the populated base event in a data store at the 
event server (Marwaha, [0038], lines 1-3)". 
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9. With respect to Claims 5 and 25, the combination of Marwaha and Natarajan 
disclose: "further comprising: querying the event server to obtain status information of a 
system associated with the event source based on the stored common event format 
representation of the populated base event (Marwaha, [0045], lines 10-13)". 

1 0. With respect to Claims 8 and 1 8, the combination of Marwaha and Natarajan 
disclose: "wherein the directory service comprises a Java Naming and Directory(JNDI) 
service (Natarajan, Col. 26, lines 6-10)". 

1 1 . With respect to Claims 1 0 and 29, the combination of Marwaha and Natarajan 
disclose: "wherein the populated base event comprises a date and/or time stamp 
(Marwaha, [0026], lines 3-7, the "OriginDateTime", further defined below as "The 
date/time that the event occurred at the origin" Page 14, 2nd Col., under the 
OriginDateTime heading), a situation type (Marwaha, [0026], lines 3-7, the 
"ObjectClass", further defined below as "The category to which the object belongs" 
Page 15, 1st Col. Under the heading "ObjectClass"), an identity of the event source 
and/or an identity of a component reporting the situation type (Marwaha, [0026], lines 3- 
7, the "Object", further defined below as "The affected component for which the event 
was generated" Page 15, 1st Col. Under the heading "Object")". 

12. With respect to Claims 1 1 and 30, the combination of Marwaha and Natarajan 
disclose: "wherein generating comprises automatically generating a common event 
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format representation of tlie populated base event based on tlie predefined event 
format (IVIanA/aha, [0027], lines 1-3)". 

13. With respect to Claim 14, tine combination of Marwalia and Natarajan disclose: 
"The system of Claim 12, wherein the source specific situation information is provided in 
a plurality of event fields (Marwaha, [0026], lines 2-7) and wherein the content handler 
module is further configured to: determine if ones of the plurality of event fields conform 
to a predefined event format defined by the content handler module (Marwaha, [0017], 
lines 1-3, "The following tables show examples of tokens and their values that may be 
updated", if the value are to be updated, they are checked against some standard, see 
[0030], lines 1 -5); modify the format of the ones of the plurality of event fields that do not 
conform to the predefined event format (Marwaha, [0017], lines 1-3, "The following 
tables show examples of tokens and their values that may be updated"); determine if 
ones of the plurality of event fields are empty (Marwaha, [0027], lines 1-3, "The 
following tables show examples of tokens and their values that may be updated or 
assigned values", assigning a value implies the value was not present during an 
inspection stage); and populate the empty ones of the plurality of event fields with 
source specific situation information based on the predefined event format (Manwaha, 
[0027], lines 1-3, "The following tables show examples of tokens and their values that 
may be updated or assigned values")". 
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14. With respect to Claim 15, the combination of Marwaha and Natarajan disclose: 
"The system of Claim 12, wherein the event server is further configured to store the 
common event format representation of the populated base event object in a data store 
at the event server (Marwaha, [0038], lines 1-3)". 

1 5. With respect to Claim 1 6, the combination of Marwaha and Natarajan disclose: 
"The system of Claim 15, further comprising a consumer module (Marwaha, Figure 3, 
object 314) configured to query the event server to obtain status information of the 
system based on the stored common event format representation of the populated base 
event object (Marwaha, [0042], lines 1-6)". 

1 6. With respect to Claim 1 9, the combination of Marwaha and Natarajan disclose: 
"The system of Claim 12, wherein the populated base object comprises a date and/or 
time stamp (Marwaha, [0026], lines 3-7, the "OriginDateTime", further defined below as 
"The date/time that the event occurred at the origin" Page 14, 2nd Col., under the 
OriginDateTime heading), a situation type (Marwaha, [0026], lines 3-7, the 
"ObjectClass", further defined below as "The category to which the object belongs" 
Page 15, 1st Col. Under the heading "ObjectClass"), an identity of the event source 
and/or an identity of a component reporting the situation type (Marwaha, [0026], lines 3- 
7, the "Object", further defined below as "The affected component for which the event 
was generated" Page 15, 1st Col. Under the heading "Object")". 



Application/Control Number: 10/809,175 Page 14 

Art Unit: 2100 

1 7. With respect to Claim 28, the combination of Marwaha and Natarajan disclose: 
"The computer program product of Claim 21 , further comprising computer readable 
program code configured to request that the content handler modify the populated base 
event based on the predefined event format (Marwaha, [0027], lines 1-3)". 

Response to Arguments 

1 8. Applicant's arguments, see pg 1 1 , lines 11-12, filed 3/20/2008, with respect to 
the drawing objections have been fully considered and are persuasive. The objection of 
the drawings has been withdrawn. 

1 9. Applicant argues on page 1 1 , lines 1 6-20, filed 3/20/2008, "Marwaha merely 
discloses converting a received event to a common event format, irrespective of a 
format of the received event", and that "applicants claimed subject matter only converts 
a received event to a common event format when the received event is not already in 
the common event format" have been fully considered and are not persuasive. 
Marwaha discloses: "The following tables show examples of the tokens and their values 
that may be updated" ([0027], lines 1-2), and see the table below [0027], 
OriginDateTime, Remarks, "If the original date/time is present, then that may be used". 
Therefore, the process of normalization includes determining whether the format is 
already acceptable. If the format is acceptable, the system uses that value, if the format 
is not acceptable the normalization phase will update the value. 
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20. Applicant argues on page 1 1 , lines 21 -22, filed 3/20/2008, "Marwaha does not 
teach or suggest a method that includes an event source that accesses an event factory 
to obtain a common base event that is populated" have been fully considered and are 
not persuasive. Marwaha discloses: "At 202, a listener or receiver listens (event 
source) for incoming alerts (from an event factory)... In data enrichment phase, a 
transformer 206, for example, additional data associated with the message. These 
additional data added during data enrichment phase (data added forms a common base 
event that is populated)" ([0025], lines 3-14). 

21 . Applicant argues on page 1 1 , lines 22-24, and lines 26-29, and on pg 12, lines 4- 
7, filed 3/20/2008, Marwaha does not teach or suggest a common base event is 
"returned to the event source (in the form of a populated based event incorporated in a 
content handler)" have been fully considered and are persuasive. Therefore, the 
rejection has been withdrawn. However, upon further consideration, a new ground(s) of 
rejection is made in view of Natarajan. Natarajan discloses: "The information which is 
reported to the data store 252 is analyzed by a policy engine 254. The policy engine 
254 includes a plurality of application specific plug-in policies for analyzing application 
specific information from the data store and for computing updated control information 
based upon the analysis of the information (in the form of a populated based event, 
updated control information, incorporated in a content handler, policy engine). The 
updated control information may include any type of information, parameters, and/or 
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actions which may be used to affect the operation of one or more network elements. 
The updated control information is then fed back to selected network elements (returned 
to the event source) to thereby affect operation of the selected elements and/or 
network" (Col. 7, lines 19-29). 

22. Applicant argues on page 12, lines 7-9, filed 3/20/2008, "Natarajan, while being 
directed to a network that employs events and directory services, is not directed to a 
network that converts events to a common event format" have been fully considered but 
are not persuasive. Natarajan was used in conjunction with Marwaha to form a 103 
obvious rejection, Marwaha discloses a network that converts events to a common 
event format ([001 1], lines 1-4). 

23. Applicant argues on page 12, lines 10-13, filed 3/20/2008, Natarajan "does not 
teach or suggest a method or computer readable program code (system) that includes 
an event source that accesses an event factory (module) to obtain a common base 
event (object) that is populated and returned to the event source (in the form of a 
populated based event incorporated in a content handler (module))" have been fully 
considered and are persuasive. Therefore, the rejection has been withdrawn. 
However, upon further consideration, a new ground(s) of rejection is made from 
Marwaha in view of Natarajan. Marwaha discloses: "At 202, a listener or receiver 
listens (event source) for incoming alerts (from an event factory)... In data enrichment 
phase, a transformer 206, for example, assitional data associated with the message. 
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These additional data added during data enrichment phase (data added forms a 
common base event that is populated)" ([0025], lines 3-14). Natarajan discloses: "The 
information which is reported to the data store 252 is analyzed by a policy engine 254. 
The policy engine 254 includes a plurality of application specific plug-in policies for 
analyzing application specific information from the data store and for computing updated 
control information based upon the analysis of the information (in the form of a 
populated based event, or updated control information, incorporated in a content 
handler, or policy engine). The updated control information may include any type of 
information, parameters, and/or actions which may be used to affect the operation of 
one or more network elements. The updated control information is then fed back to 
selected network elements (returned to the event source) to thereby affect operation of 
the selected elements and/or network" (Col. 7, lines 19-29). 



Conclusion 



24. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MATTHEW S. LINDSEY whose telephone number is 
(571)270-381 1 . The examiner can normally be reached on Mon-Thurs 7:30-5, Fridays 
7:30-1 . 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Follansbee can be reached on (571) 272-3964. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

MSL 
5/8/2008 

/John Follansbee/ 

Supervisory Patent Examiner, Art Unit 2151 



